FCSS_CDS_AR-7.6 Exam Training Practice Tests (Fortinet FCSS - Public Cloud Security 7.6 Architect)]

Question 1

An administrator is trying to implement FortiCNP with Microsoft Azure Security integration.
However, FortiCNP is not able to extract any cloud integration data from Azure; therefore, real- time cloud security monitoring is not possible.
What is causing this issue?

A. The administrator enabled the wrong Defender plan for servers. B. The organization is using a free Azure AD license. C. The FortiCNP account in Azure has the Storage Blob Data Reader role. D. The Azure account doesn't have the Global Administrator role.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 2

An administrator decides to use the Use managed identity option on the FortiGate SDN connector with Microsoft Azure. However, the SDN connector is failing on the connection. What must the administrator do to correct this issue?

A. Make sure to add the Client Secret on the FortiGate side of the configuration. B. Make sure to add the Tenant ID on the FortiGate side of the configuration. C. Make sure to enable the system-assigned managed identity on Azure. D. Make sure to set the type to system managed identity on FortiGate SDN connector settings.

Correct Answer: C

Question 3

An AWS administrator must ensure that each member of the cloud deployment team has the correct permissions to deploy and manage resources using CloudFormation. The administrator is researching which tasks must be executed with CloudFormation and therefore require CloudFormation permissions.
Which task is run using CloudFormation?

A. Deploying a new pod with a service in an Elastic Kubernetes Service (EKS) cluster using the kubectl command B. Creating an EKS cluster with the eksctl create clustercommand C. Installing a Helm chart to deploy a FortiWeb ingress controller in an EKS cluster D. Changing the number of nodes in an EKS cluster from AWS CloudShell

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 4

Your organization has several FortiGate VMs deployed in Azure. You need to implement a solution with Azure native tools that allows you to determine whether packets are being permitted or blocked by the FortiGate VMs.
Which solution can you use to meet these requirements?

A. Install the Azure Monitor agent in all VMs. B. Insert the VM traffic logs in Azure Sentinel. C. Configure Azure Advisor to analyze the network traffic. D. Use IP flow verify for each of the VMs.

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 5

Refer to the exhibit. What is the purpose of this section of an Azure Bicep file?

A. To add a comment with the permitted FortiOS versions that can be deployed B. To document the FortiOS versions in the resulting topology C. To indicate the correct FortiOS upgrade path after deployment D. To restrict which FortiOS versions are accepted for deployment

Correct Answer: D

Question 6

In an SD-WAN TGW Connect topology, which three initial steps are mandatory when routing traffic from a spoke VPC to a security VPC through a Transit Gateway? (Choose three.)

A. From the security VPC TGW subnet routing table, point 0.0.0.0/0 traffic to the TGW. B. From both spoke VPCs and the security VPC, point 0.0.0.0/0 traffic to the Internet Gateway. C. From the spoke VPC internal routing table, point 0.0.0.0/0 traffic to the TGW. D. From the security VPC TGW subnet routing table, point 0.0.0.0/0 traffic to the FortiGate internal port. E. From the security VPC FortiGate internal subnet routing table, point 0.0.0.0/0 traffic to the TGW.

Correct Answer: A,C,D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

An Azure administration team is looking for a FortiGate high availability (HA) solution that is able to:
- Filter east-west traffic
- Filter north-south traffic
- Scale up
- Scale out
Which HA deployment meets all of the requirements?

A. Active-active with Azure Gateway load balancer B. Active-passive with SDN connector C. Active-active with external and internal load balancers D. Active-passive with external and internal load balancers

Correct Answer: C

Question 8

Refer to the exhibit. After analyzing the native monitoring tools available in Azure, an administrator decides to use the tool displayed in the exhibit.
Why would an administrator choose this tool?

A. To view details about Azure resources and their relationships across multiple regions. B. To compare the latency of an on-premises site with the latency of an Azure application. C. To obtain, and later examine, traffic flow data with a visualization tool. D. To help debug issues affecting virtual network gateways.

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Fortinet FCSS - Public Cloud Security 7.6 Architect - FCSS_CDS_AR-7.6 Exam Practice Test